From http://aluigi.org/poc.htm:
Quake 3 engine Cbuf_Execute commands execution universal proof-of-concept 0.1 (q3cbufexec)
universal patcher which gets the original client executable of a game based on the Quake 3 engine and generates a new modified one which converts the ‘;’ chars in the commands sent by the client to carriage-returns for testing a vulnerability which allows to execute server’s game commands through a malformed callvote.
details of the vulnerability are available here and here.
examples of malformed callvote commands to use from the console of the modified game executable:
/callvote map “none;rconpassword empty”
/callvote timelimit “123;rconpassword none”
Is there a patch available fpr W:ET? It seems this exploit is atm repeatedly used on several servers: http://forum.splatterladder.com/index.php?showtopic=10061&hl=